Java SE download links now require custom hash

Previously the urls all followed the same predictable format, based on version and build:

/java/jdk/{BUILD}/jdk-{VERSION}-linux-x64.tar.gz

Newer downloads now require a randomized hash, unique to each version but the same across all package formats (RPM, TGZ, etc.)

/java/jdk/{BUILD}/{HASH}/jdk-{VERSION}-linux-x64.tar.gz

Many build scripts are used to parameterizing just the version

For anyone downloading Oracle Java as part of automated builds, this could be a headache. A great many build scripts are used to parameterizing just the version, and needing to lookup a new url for each release will have a reduced maintenance/security impact on the open-source community. Of course Oracle is free to release it’s builds however it desires.

Personally, this is one of those rare moments where time spent automating something pays true dividends. Latestver has included Java tracking from day one, with support for download urls.

Latestver is of course how BinaryBabel’s JDK Docker Images are updated. So addressing this change Oracle’s releases was really a matter of updating Latestver to support the new hashes, and then sitting back and watching, well, nothing really… No broken builds, or out-of-date runtimes, and no time spent updating build scripts by hand. Once and a while the Gods of Automation do smile, and it’s wondrous to behold.

So for those wondering, what to do now?

Here’s some shameless self-promotion by way of a couple of Latestver tactics you might want to deploy.